Cookie banners made people aware that websites remember them. Fewer people know that a page can recognise a browser without storing anything, just by reading details the browser hands over to every site. This article goes through what those details are (our browser info page lists yours, read locally), explains with simple arithmetic why ordinary values add up to an identifier, and separates the defences that help from those that do not.
What any page can read without asking
None of the following triggers a permission prompt:
- The User-Agent string and, in Chromium browsers, client hints: browser, version, operating system, sometimes CPU architecture and device model.
- Screen: size, available area (which reveals the taskbar or dock), device pixel ratio, colour depth, colour gamut, HDR.
- Language and time: the full list of preferred languages, the time zone, how dates and numbers are formatted.
- Input and preferences: touch points, whether the main pointer is a mouse or a finger, dark mode, reduced motion, high contrast.
- Hardware hints: the number of logical CPU cores and a rounded memory size.
- Graphics: through WebGL, usually the name of the GPU and its driver.
- Features: which of hundreds of APIs and formats the browser supports, which narrows down the exact version.
There are also slower techniques: drawing text on a hidden canvas and hashing the pixels (fonts and anti-aliasing differ between systems), measuring audio processing, or listing installed fonts by measuring text. They work for the same reason: tiny differences in software and hardware.
Why ordinary details add up
No single value identifies you. A useful way to see how they combine is bits of information. If a value is shared by 1 in N browsers, knowing it gives log₂(N) bits. Telling apart about 8 billion people takes log₂(8,000,000,000) ≈ 33 bits.
Take some made-up but plausible frequencies (they are illustrations, not measurements):
| Detail | Shared by | Bits |
|---|---|---|
| Time zone | 1 in 20 | 4.3 |
| Screen size and pixel ratio | 1 in 50 | 5.6 |
| Language list | 1 in 10 | 3.3 |
| Browser and version | 1 in 4 | 2.0 |
| Operating system | 1 in 3 | 1.6 |
If the details were independent, together they would give about 16.9 bits: 1 in about 120,000 browsers would match. Add the GPU renderer, core count, available screen area, installed fonts and a canvas hash, and the total can pass 33 bits. Real values are not independent (a Mac user's screen size correlates with the OS), so the true number is lower than the simple sum, but the principle holds: many small pieces of entropy become an identifier.
This is not hypothetical. The EFF's Panopticlick study (2010) found that most browsers in its sample had a fingerprint no other browser in the sample shared. Browsers have reduced the exposed detail since, but the technique is still in use.
Why it is harder to escape than cookies
A cookie is stored on your device, so you can delete it, block it or open a private window. A fingerprint is computed from what your browser is, every time you visit. Clearing cookies does not change your screen size, time zone or GPU. Private windows usually report the same values. That is why European data-protection guidance treats it like cookies, as tracking that needs consent, and why browser makers have been cutting what is exposed: frozen User-Agent versions, rounded memory values, fewer font details.
What helps, and what backfires
Helps:
- Browsers with fingerprinting protection that report standardised values or add noise (for example Tor Browser, Firefox's resist-fingerprinting mode, Brave's farbling, Safari's reduced detail). The goal is to look like many other browsers.
- Tracker blockers, which stop many fingerprinting scripts from loading at all.
- Default settings and up-to-date versions: the more common your configuration, the larger the crowd you hide in.
Backfires:
- Many extensions, unusual fonts and custom settings. Each one makes your browser rarer.
- Changing the User-Agent string by hand. A browser claiming to be Safari while supporting Chrome-only APIs is more distinctive, not less.
- Assuming a VPN hides you. A VPN changes your IP address; the fingerprint stays identical.
Common mistakes in thinking about it
- "My IP is hidden, so I am anonymous." The browser details are separate from the IP address. (Our tool does not even check your IP: a page cannot see it without asking a server.)
- "Private browsing stops fingerprinting." It stops stored identifiers; computed ones mostly remain.
- "A unique-looking result means I am tracked." Uniqueness is a measure of risk, not proof of use. Whether a site fingerprints depends on its scripts.
- "Turning everything off is safest." Disabling JavaScript stops most fingerprinting but breaks many sites, and being one of the few with JavaScript off is itself a signal.
Look at your own report: the values marked ● on the browser info page are the ones fingerprinting scripts typically combine. The hash computed there from them is an illustration, made on the page and sent nowhere. While you are checking your device, the screen test shows what your display itself can do.